Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5020fb4ac78166754a595b80274b8ce38d2b14165dff1a2794368dca3612805c
-
Size
874KB
-
Sample
230315-p5214sdb92
-
MD5
cf017376abd2d1fe4d7d20b0f98e8d09
-
SHA1
ba5165d6be8250b08b97caef3f9974acda27e013
-
SHA256
5020fb4ac78166754a595b80274b8ce38d2b14165dff1a2794368dca3612805c
-
SHA512
614003915dc82ba9768f6305d82f87444d90042af32ec22f6caa083c4ad0d2d74dc743ff8b69ca6718de9f78c434a6ff532583549b547ae2a7cf45dbc9a43008
-
SSDEEP
12288:cMrpy904BJsLRE91tuKyCz9cN9rST9ySgmFhl5tUR6am8HbhdnlhGj15SPO5ym0M:FyMLRenxjhlf06d8zlhc5BdzVf9
Static task
static1
Behavioral task
behavioral1
Sample
5020fb4ac78166754a595b80274b8ce38d2b14165dff1a2794368dca3612805c.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
sito
193.233.20.28:4125
-
auth_value
030f94d8e396dbe51ce339b815cdad17
Targets
-
-
Target
5020fb4ac78166754a595b80274b8ce38d2b14165dff1a2794368dca3612805c
-
Size
874KB
-
MD5
cf017376abd2d1fe4d7d20b0f98e8d09
-
SHA1
ba5165d6be8250b08b97caef3f9974acda27e013
-
SHA256
5020fb4ac78166754a595b80274b8ce38d2b14165dff1a2794368dca3612805c
-
SHA512
614003915dc82ba9768f6305d82f87444d90042af32ec22f6caa083c4ad0d2d74dc743ff8b69ca6718de9f78c434a6ff532583549b547ae2a7cf45dbc9a43008
-
SSDEEP
12288:cMrpy904BJsLRE91tuKyCz9cN9rST9ySgmFhl5tUR6am8HbhdnlhGj15SPO5ym0M:FyMLRenxjhlf06d8zlhc5BdzVf9
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-